Privacy policy
This is an English translation of our privacy policy, provided for your convenience. In the event of any discrepancy, the German version shall prevail.
1. Privacy at a glance
Protecting your personal data is important to us. This website has been deliberately designed to collect as little data as possible: it uses no cookies, no analytics, tracking or advertising services, and it does not create user profiles. A cookie consent banner is therefore not required. The following information gives you an overview of what happens to your personal data when you visit this website or get in touch with us.
2. Controller
The controller responsible for data processing on this website is:
CABOA GmbH
Konrad-Adenauer-Str. 56
53757 Sankt Augustin
Germany
Represented by: Michael Boshammer
Email: mb@caboa.de
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.
3. Hosting and server log files
This website is hosted on Google Cloud Platform (“Cloud Run” service). The provider is Google Cloud EMEA Limited, Dublin, Ireland (“Google”). The servers are located in the European Union (region europe-west1, Belgium).
When you visit the website, information transmitted by your browser is automatically stored in so-called server log files. This includes in particular: IP address, date and time of the request, the page or file requested, referrer URL, browser type and version, and the operating system used. This data is not combined with other data sources and is used solely to ensure the smooth and secure operation of the website, for example to analyse errors and fend off attacks. The log files are deleted automatically after 30 days.
The legal basis is our legitimate interest in providing the website in a technically error-free and secure manner (Art. 6(1)(f) GDPR).
Google processes this data on our behalf. It cannot be ruled out that Google LLC (USA) may gain access to data, for example in the course of maintenance and support. Google LLC is certified under the EU-US Data Privacy Framework, so transfers to it are covered by an adequacy decision of the European Commission (Art. 45 GDPR). Further information: cloud.google.com/privacy.
4. SSL/TLS encryption
For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser’s address bar starting with “https://” and by the padlock symbol in your browser bar.
5. Contacting us
The contact form on this website does not transmit any data to our server: when you submit it, your email program opens with a prepared message to us, which you review and send yourself. If you contact us in this way, by email or by phone, your enquiry, including the contact details you provide, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. We will not pass this data on without your consent and – in keeping with the nature of our business – treat it as strictly confidential.
The data is processed on the basis of Art. 6(1)(b) GDPR if your enquiry relates to the performance of a contract or to pre-contractual measures; otherwise, it is processed on the basis of our legitimate interest in handling the enquiries addressed to us effectively (Art. 6(1)(f) GDPR). Your data will be deleted as soon as it is no longer required for the purpose for which it was collected and no statutory retention obligations apply.
6. Newsletter
On the Insights pages, you can subscribe to our quarterly report on market trends. Here, too, no data is transmitted to our server: your email program opens with a prepared sign-up message to us. By sending this email, you consent to us storing your email address and sending you the newsletter.
The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, for example by sending a short email to mb@caboa.de. Your email address will then be removed from our mailing list.
7. Scheduling appointments (Calendly)
To schedule initial meetings, we link to the appointment booking service Calendly (Calendly LLC, Atlanta, USA). The service is not embedded in our website; only when you follow the link do you leave our website, and Calendly’s privacy notice then applies: calendly.com/privacy.
8. Images from stock photo providers
On this website, we use royalty-free stock photos from the provider Unsplash (Unsplash Inc., Montreal, Canada). Some of these images are loaded directly from the provider’s servers (images.unsplash.com). When you open a page containing such images, your IP address is transmitted to the provider’s servers, as this is technically necessary to deliver the images. Canada is covered by an adequacy decision of the European Commission (Art. 45 GDPR). For further information, please see Unsplash’s privacy policy: unsplash.com/privacy.
The images are embedded on the basis of our legitimate interest in an appealing presentation of our website (Art. 6(1)(f) GDPR).
9. Fonts (hosted locally)
For a consistent appearance, this website uses fonts that are stored locally on our server. No connection is made to Google servers (Google Fonts) or to any other third-party provider.
10. Your rights
Within the scope of the applicable statutory provisions, you have the right at any time to obtain information free of charge about your stored personal data, its origin and recipients, and the purpose of the data processing (Art. 15 GDPR), as well as the right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You may object to processing based on our legitimate interest on grounds relating to your particular situation (Art. 21 GDPR). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR).
For these and any other questions about data protection, you can contact the controller named above at any time.
11. Right to lodge a complaint with a supervisory authority
In the event of a breach of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (www.ldi.nrw.de).
12. Changes to this privacy policy
We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to reflect changes to our services. The version in force at the time of your next visit will then apply.
Last updated: October 2026